TMA-GITLAB-1.2.7
Ensure inactive repositories are reviewed and archived periodically
Beschreibung
Track inactive repositories and remove them periodically. Inactive repositories (i.e., no new changes introduced for a long period of time) can enlarge the surface of a potential attack or data leak. These repositories are more likely to be improperly managed, and thus could possibly be accessed by a large number of users in an organization.
So wird geprüft
Prüfmethode: Manuelle Prüfung
Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.
Perform the following to ensure that all the projects in the organization are active. For each group: - Navigate to the group homepage. - Expand any sub-groups. - For each project, review the updated date and ensure it has been updated within the last 6 months.
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Perform the following to remediate the presence of inactive projects. For each inactive project identified during the audit: - Navigate to the project homepage. - In the sidebar, select Settings > General. - In the 'Advanced' section, select 'Expand'. - Select 'Archive project'. - Read the warning. - Select 'Archive project'. To automate the deletion of inactive projects, perform the following steps as an Administrator: - On the left sidebar, at the bottom, select Admin Area. - Select Settings > Repository. - Expand Repository maintenance. - In the Inactive project deletion section, select Delete inactive projects. - Configure the settings. o The warning email is sent to users who have the Owner and Maintainer role for the inactive project. o The email duration must be less than the Delete project after duration. - Select Save changes.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- devsecopsgitlab
- Referenz
- CIS GitLab Benchmark v1.0.1 - 1.2.7 Ensure inactive repositories are reviewed and archived periodically